I have configured my access switch interfaces with DOT1X authentication from Radius server. And my end host connected with these interfaces are getting their IP from DHCP server. But since my end host clients are not able to authenticate successfully, hence DHCP is not assigning them IP. I am able to ping the ISE servers from switch. Kindly suggest possible solution or do I need to check with ISE server owner.
Below is the logs captured from switch.
switch#sh logging | i 1/23
May 14 2021 21:02:46.033 UTC: %DOT1X-5-FAIL: Authentication failed for client (xxxx.xxxx.xxxx) on Interface Gi1/23
May 15 2021 03:01:44.304 UTC: %DOT1X-5-FAIL: Authentication failed for client (xxxx.xxxx.xxxx) on Interface Gi1/23
switch#sh run int gig1/23
Building configuration...
Current configuration : 1040 bytes
!
interface GigabitEthernet1/23
switchport access vlan XXXX
switchport mode access
switchport voice vlan YYYY
ip access-group ACL-NAME in
no logging event link-status
speed auto 10 100 1000
authentication event fail action next-method
authentication event server dead action authorize vlan XXXX
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity server
authentication violation restrict
mab
snmp trap mac-notification change added
no snmp trap link-status
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
ip dhcp snooping limit rate 15
end
switch# sh run | i dot1x
aaa authentication dot1x default group ISE_SERVERS
aaa accounting dot1x default start-stop group ISE_SERVERS
